How NFS Works: Exports, Mounts & Insecure Shares (Animated)
NFS is how Linux and Unix machines share folders over the network, the Linux counterpart of SMB. Older NFS versions trust the client to say which user it is, so an export that is open to everyone can hand over files, or a whole server, to any machine on the network.
1. List & mount: which folders are shared?
The client asks which folders the server exports, then mounts one so it appears as a local folder.
- MOUNT (Linux workstation → NFS file server): The client asks to mount the export.
- MOUNT REPLY (NFS file server → Linux workstation): Mounted.
Wireshark filter:
nfs || mount
2. Read a file: the client says which user it is
In classic NFS (AUTH_SYS), each request simply states a user ID and group ID. The server trusts it.
- READ (Linux workstation → NFS file server): The client claims to be user 1001.
- READ REPLY (NFS file server → Linux workstation): The server checks permissions for uid 1001 and returns the file.
Wireshark filter:
nfs.procedure_v3 == 6
3. Open export: attack: anyone can mount, root stays root
The export is open to every host (*) with no_root_squash. Any machine on the network can mount it, and a client claiming to be root is treated as root on the share, able to read every home folder and plant files.
- MOUNT (Attacker (same LAN) → NFS file server): The attacker’s machine mounts the share.
- READ (Attacker (same LAN) → NFS file server): Claiming root, the attacker reads everything.
- READ REPLY (NFS file server → Attacker (same LAN)): All home folders are exposed.
Wireshark filter:
mount && ip.src == 192.168.1.66
4. Safe exports: defence: specific hosts, root_squash, kerberos
Export only to the hosts that need it, keep root_squash, prefer read-only, and use NFSv4 with Kerberos (sec=krb5p) so the server checks real identities and encrypts traffic. Firewall 2049 and 111 to known clients.
- MOUNT (Attacker (same LAN) → NFS file server): The attacker’s host isn’t allowed to mount.
/etc/exports:
/exports/home 192.168.1.10(rw,sync,root_squash,sec=krb5p)
Practise this in a real lab
Mount NFS shares in a lab, find over-permissive exports with showmount, and fix them with host restrictions, root_squash and Kerberos.
Explore ER Segment training →FAQ
What does an NFS export line look like?
For example: /exports/home 192.168.1.0/24(rw,sync,root_squash). It lists the folder, who may mount it and options.
What is root_squash?
It maps the client’s root user to an unprivileged “nobody” user on the server. no_root_squash disables that protection.
How does NFSv4 with Kerberos help?
With sec=krb5p the server checks real user identities with Kerberos and encrypts the traffic, instead of trusting the client.